   "Checks with a tokeninfo endpoint for the token's validity and returns the session information if valid."
   [tokeninfo-url access-token]
   ; TODO make connection pool configurable!
-  (let [response (client/get tokeninfo-url
-                             {:query-params     {:access_token access-token}
-                              :throw-exceptions false
-                              :as               :json-string-keys})
-        body (:body response)]
-    (if (= 200 (:status response))
-      body
+  (try
+    (let [request-start (t/now)
+          response (client/get tokeninfo-url
+                               {:query-params     {:access_token access-token}
+                                :throw-exceptions false
+                                :as               :json-string-keys})
+          request-end (t/now)
+          body (:body response)
+          request-duration-ms (t/in-millis (t/interval request-start request-end))]
+      (when-not (< 10 request-duration-ms)
+        (log/warn "resolving tokeninfo took" request-duration-ms "ms"))
+      (if (= 200 (:status response))
+        body
+        nil))
+    (catch IOException e
+      (log/warn "could not get tokeninfo from" tokeninfo-url "because " (str e) "; rejecting token!")
       nil)))
 
 (defn check-consented-scopes

  (:require [ring.middleware.basic-authentication :refer [wrap-basic-authentication]]
            [clj-http.client :as client]
            [clojure.tools.logging :as log]
            [io.sarnowski.swagger1st.util.api :as api]))

;; functions that generate security handler

(defn- deny-response
  "Send forbidden response."
  [reason]
  (log/warnf "ACCESS DENIED because %s." reason)
  (api/error 403 "Forbidden"))

(defn allow-all

            ; check scopes
            (if (check-scopes-fn tokeninfo requirements)
              (assoc request :tokeninfo tokeninfo)
              (forbidden "scopes not granted"))
            (unauthorized "invalid access token"))
          (api/error 503 "token info misconfigured")))
      (unauthorized "no access token given"))))
